Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    10/05/2022, 22:35

General

  • Target

    f0fd5d38ffa54d8dfd6456c0b7a8664b.exe

  • Size

    4.6MB

  • MD5

    f0fd5d38ffa54d8dfd6456c0b7a8664b

  • SHA1

    36387a6cd5c900fb78e6fc67a88e84a472d05b61

  • SHA256

    4e3056448e294407b47e08e4dd3364b14acc1fe05d602cbe3347e10800f925ae

  • SHA512

    80b57e0e8feb4241631adfd73678ea8c4094397c4053855bfd3cce2d4762be8c67da46fe3e41b73766596723d370692cb31a75ba2bf475b40f2c4f2c1a9eb7db

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

https.myvnc.com:9111

Attributes
  • communication_password

    c4ca4238a0b923820dcc509a6f75849b

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe
    "C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1352
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rGucnaAeGqFkx.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1780
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rGucnaAeGqFkx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD624.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1836
    • C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe
      "C:\Users\Admin\AppData\Local\Temp\f0fd5d38ffa54d8dfd6456c0b7a8664b.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1460

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpD624.tmp

          Filesize

          1KB

          MD5

          db859e33939e1d3f71f354b4de2d9ce1

          SHA1

          cae69c1ce0a74afc32c1abd38918e7e38cf93a8d

          SHA256

          c3f9ff42c9bcedd8fa46a824f3bc979bcf1e81bff4f74d26245eac32a852cdbd

          SHA512

          188d7356d77b0f7d07ebf5d1a1f97cb81be5adcc8bfe2f9e4341bc705e3b31d3e95bfb22a751b6651f77309cae10736ad4e4c0fd0db6690047396d897fc83408

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

          Filesize

          7KB

          MD5

          1be8301f3fe6d9c8632b565855a60f22

          SHA1

          02785613b6cc3b3e2794ad004ceae76ffa2a6eb6

          SHA256

          357c3b078aa8ddefa354f97ce67113652a592303e222726858cdb575097f9bdb

          SHA512

          516c6d8a314cf40bb64b8b9c2ba88345a8415a39cff02e48f19bdd58e83f53710c66958aec1281173d15d5f08c53a9903832bf06584d710b3fc2448e1d612670

        • memory/376-66-0x000000000BBA0000-0x000000000BF72000-memory.dmp

          Filesize

          3.8MB

        • memory/376-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

          Filesize

          8KB

        • memory/376-56-0x00000000005A0000-0x00000000005AE000-memory.dmp

          Filesize

          56KB

        • memory/376-57-0x0000000009CF0000-0x000000000A0CA000-memory.dmp

          Filesize

          3.9MB

        • memory/376-54-0x0000000000950000-0x0000000000DE4000-memory.dmp

          Filesize

          4.6MB

        • memory/376-65-0x0000000002310000-0x0000000002316000-memory.dmp

          Filesize

          24KB

        • memory/1352-67-0x000000006E660000-0x000000006EC0B000-memory.dmp

          Filesize

          5.7MB

        • memory/1460-86-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-84-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-69-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-70-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-72-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-74-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-76-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-78-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-79-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1460-81-0x0000000000400000-0x00000000007CE000-memory.dmp

          Filesize

          3.8MB

        • memory/1780-68-0x000000006E660000-0x000000006EC0B000-memory.dmp

          Filesize

          5.7MB